JjondZddlmZddlZddlZddlZddlmZddlm Z m Z m Z ej e ZddlmZddlmZmZmZmZddlmZdd lmZmZmZmZmZm Z m!Z!m"Z"m#Z#m$Z$m%Z%m&Z&m'Z'm(Z(m)Z)m*Z*dd l+m,Z,m-Z-m.Z.dd l/m0Z0dd l1m2Z2m3Z3m4Z4dZd[dZ5d\dZ6d]dZ7d^dZ8d_dZ9d`d Z:dad!Z;dbd"Zddded'Z?dfd)Z@hd*ZAdgd-ZBdhd.ZCdid1ZDdddd2djd9ZEdddkd;ZF dldmd?ZGdndBZHdndCZIdodDZJdpdEZKd_dFZLdddGdqdIZMdhdJZNdrdLZOdddMdsdPZPdddMdtdQZQddddRdudSZRdddMdvdTZSdddddUdwdVZTdxdYZUdS)yzGShared runtime provider resolution for CLI, gateway, cron, and helpers.) annotationsN)urlparse)AnyDictOptional)auth)CredentialPoolPooledCredentialget_custom_provider_pool_key load_pool) get_secret) AuthErrorDEFAULT_CODEX_BASE_URLDEFAULT_QWEN_BASE_URLDEFAULT_XAI_OAUTH_BASE_URLPROVIDER_REGISTRY_agent_key_is_usable_nous_inference_env_overrideformat_auth_errorresolve_provider resolve_nous_runtime_credentials!resolve_codex_runtime_credentials%resolve_xai_oauth_runtime_credentials resolve_qwen_runtime_credentials$resolve_api_key_provider_credentials-resolve_external_process_provider_credentialshas_usable_secret)get_compatible_custom_providers load_confignormalize_extra_headers)OPENROUTER_BASE_URL)base_url_host_matchesbase_url_hostnameenv_intnamestrdefaultreturnc.t||}||n|S)aProfile-scoped replacement for ``os.getenv`` on credential/provider reads. Routes through the secret scope (Workstream A): identical to ``os.getenv`` when multiplexing is off, scope-aware (and fail-closed on an unscoped read) when on. Genuinely-global vars are handled inside ``get_secret`` and still read ``os.environ``. Keeps the ``(name, default) -> str`` contract every call site here already relies on. ) _get_secret)r&r(vals A/home/rurouni/.hermes/hermes-agent/hermes_cli/runtime_provider.py_getenvr.+s! dG $ $C/33w.valuecv|ddS)N -)striplowerreplacer0s r-_normalize_custom_provider_namer88s, ;;==   ( (c 2 22r/hostboolc\|pdd}|dvS)Nr%.>::10.0.0.0 localhost 127.0.0.1)r5rstrip)r9hs r-_loopback_hostnamerC<s1 ##C((A < <!!i:&=&=## 4r/ model_cfgDict[str, Any]ct|d}t|}|dkr%|dkrtd|pdd}|p|pdS)aResolve api_mode for legacy/plain ``provider: custom`` endpoints. Custom endpoints should stay conservative by default. Only direct OpenAI/xAI URLs imply Responses API automatically; named custom providers can opt in via their own ``api_mode`` field. This also prevents a stale persisted ``model.api_mode: codex_responses`` from forcing generic relays onto the Responses path after upgrades or /reset. api_moderTzMIgnoring persisted custom api_mode=codex_responses for non-OpenAI endpoint %sz (unknown)Nchat_completions)_parse_api_modegetr[loggerinfo)r\rPconfigured_mode detected_modes r-_resolve_plain_custom_api_modergsz&immJ&?&?@@O,X66M+++ AR0R0R [  #      Am A/AAr/crt|}|sdStd|ddDrdS|dvsd|vrdSd|dD}|r+|dd vr!|d|r |dd v!t |d krdS|d }dd |D}|r|dsdS|d vrdS|d}t|dpd S)u_Look up `_API_KEY` in the env, derived from the base URL host. Examples: https://api.deepseek.com/v1 → DEEPSEEK_API_KEY https://api.groq.com/openai/v1 → GROQ_API_KEY https://api.mistral.ai/v1 → MISTRAL_API_KEY https://generativelanguage.googleapis.com/v1beta/openai/ → GOOGLEAPIS_API_KEY Returns the env value (stripped) or "". Never returns env vars whose names are already explicitly checked elsewhere — those are handled by their own host-gated paths (OPENAI/OPENROUTER/OLLAMA). The vendor label is the *registrable* portion of the hostname: strip ``api.`` / ``www.`` prefixes, then take the second-to-last label (``api.deepseek.com`` → ``deepseek``). Falls back to "" for hostnames that don't yield a usable vendor label (IPs, loopback, single-label hosts). r%c3>K|]}|VdSN)isdigit.0chs r- z(_host_derived_api_key..s* : :B2::<< : : : : : :r/r<)r?:cg|]}||Srs)rmlbls r- z)_host_derived_api_key..s 8 8 8cC 8c 8 8 8r/r)apiwwwc3FK|]}|r|ndVdS)_N)isalnumrls r-roz(_host_derived_api_key..s3EEbjjll3EEEEEEr/)OPENAI OPENROUTEROLLAMA_API_KEY) r#anysplitpoplenjoinupperisalphar.r4)rPrZlabelsvendor sanitizedenv_names r-_host_derived_api_keyrsv&!**H r : :(.."5"5b"9 : : :::r>!!SH__r 8 8X^^C00 8 8 8F VAY.00 1  VAY.00 6{{QrBZFEEfEEEEEKKMMI IaL0022r666r%%%H Hb ! ! 'R . . 0 00r/cD|pd}|sdSt|pd}|sdS|dks*|ds|drdS|drdSt |dkrdSdS) uDecide whether a configured ``model.base_url`` may back native Anthropic. Native ``provider: anthropic`` resolution honors ``model.base_url`` so users can point at Anthropic-compatible endpoints (official Anthropic/Claude hosts, Azure Foundry, MiniMax/Zhipu/LiteLLM-style ``/anthropic`` proxies, Kimi's ``/coding`` route). But a config can carry a *stale* non-Anthropic URL — e.g. ``provider: anthropic`` left with ``base_url: https://openrouter.ai/api/v1`` after a provider switch — which would route Anthropic OAuth/setup-token traffic to an OpenAI-compatible aggregator and 404. Ignore those. Returns True only when the URL plausibly speaks the Anthropic Messages protocol; otherwise the caller falls back to ``https://api.anthropic.com``. r%FrUz.anthropic.comz .claude.comTz .azure.comrV)r4r#r5rXr[)rP candidaterZs r-_anthropic_base_url_override_okrsR&&((I u!),,299;;H u&&&(*;*;r002288::06B==??EEGG th&&$0_4I4T4TU^4_4__ $7 77r/api_keyct|dpd}t |d}|rt d|r|St|dpd}|sdS ddlm}||| S#t$rYdSwxYw) Nrr%r_copilotr(r`r)copilot_model_api_mode)r) r'rbr4r5rarhermes_cli.modelsrrK)r\rrre model_namers r-_copilot_runtime_api_moder:simmJ77=2>>DDFFLLNN%immJ&?&?@@O? K^__Y]]9--344::<rTbedrock_converser`codex_app_serverrVrawrct|tr1|}|tvr|SdS)z@Validate an api_mode value from config. Returns None if invalid.N)rr'r4r5_VALID_API_MODES)rrYs r-raraZsD#sYY[[&&(( ) ) )  4r/c"tpdS)uVReturn the trusted Nous runtime base URL override, if configured. Delegates to ``auth._nous_inference_env_override`` so every ``NOUS_INFERENCE_BASE_URL`` read shares one normalization path (trailing-slash stripping, blank → empty). The env source is trusted and intentionally bypasses the network host allowlist there. r%)rrsr/r-!_nous_inference_base_url_overridercs ( ) ) /R/r/r_Optional[Dict[str, Any]]c|s|S|dvr|St|dpd}|dkrdS|S)uOptional opt-in: rewrite api_mode → "codex_app_server" for OpenAI/Codex providers when the user has explicitly enabled that runtime via `model.openai_runtime: codex_app_server` in config.yaml. Default behavior is preserved: when the key is unset, "auto", or empty, this function is a no-op. Only providers in {"openai", "openai-codex"} are eligible — other providers (anthropic, openrouter, etc.) cannot be rerouted through codex. Returns the (possibly-rewritten) api_mode.>openai openai-codexopenai_runtimer%r)r'rbr4r5)rr_r\runtimes r-%_maybe_apply_codex_app_server_runtimernsp 111)-- 0117R88>>@@FFHHG$$$!! Or/)r\pool target_modelentryr requested_providerrOptional[CredentialPool]rc  |p t}|p|dpd}t|ddpt|ddpdd}t|ddpt|dd}d} |d kr d } |pt}n|d kr d } |pt }n|d kr d} |pt }n|d kr%d} tj|} |p | r| jnd}n|dkrd} t|dpd } d} | dkrZt|dpd d} t| sd} | p|pd}n|dkr |pt}n|dkrd } n|dkrd} tp|}n|dkr5t|t|dd} |ptdj}n\|dkrt|dpd } | dkrst|dpd d} | r| }t!|d} | r| } |r/| dkr) ddlm}||}n#t&$rd}YnwxYw|r|} | dkrt)jdd|}nEt|dpd }tj|} | o0|d| jdk}||krO|rMt|dpd d} | r| }t!|d} |dvrddlm}|||} n(| rt/||r| } nt1|}|r|} |dvrddlm}||| |}t5|| |} |dkrt7j|}|| ||t|d d!||d"S)#Nr(r%runtime_base_urlrPrSruntime_api_key access_tokenr`rrT xai-oauth qwen-oauth minimax-oauthrV anthropicrhttps://api.anthropic.com openrouterxainousr azure-foundryr_razure_foundry_model_api_mode/v1/?$ opencode-go opencode-zenopencode_model_api_modenormalize_opencode_base_url)rr_r\lmstudiosourcer)rr_rPrrcredential_poolr)rrbgetattrrArrrrinference_base_urlr'r4r5rr!rrrarrrKresubrrr[rrauth_mod$_normalize_lmstudio_runtime_base_url)rrrr\rreffective_modelrPrr_pconfigrErDrerinferredrpool_url_is_defaultrrrs r- _resolve_runtime_from_pool_entryrs0.00I$Ey}}Y'?'?E2O1488bGE:W[<\<\b`bjjknooHe.55[XZ9[9[G!H>!!$55 [ $99 \ ! !%44 _ $ $ (#'11Ng M : :2 [ '9==44:;;AACCIIKK  ; & &y}}Z88>B??EEGGNNsSSL2<@@ "! J8J/J \ ! !22 U  $ V  %466B( Y  ,YGXZ\8]8]^^N0;N _ $ $9==44:;;AACCIIKK ? * *y}}Z88>B??EEGGNNsSSL ('-immJ.G.GHHO +*  $x+??? JJJJJJ77HH     $# + + +viX66H!)-- ";";"ArBBHHJJPPRR $'11%h(//#*>*>'B\BcBcdgBhBh*h ( * */B *y}}Z88>B??EEGGNNsSSL ('))-- *C*CDD 6 6 6 B A A A A A..xIIHH  $!EhPc!d!d $&HH 099H $#222AAAAAA..x8LL5H H:@JJ%6220  s$K66 LL requestedc|r:|r&|St}|d}t |t r:|r&|St dd}|r|SdS)z=Resolve provider request from explicit arg, config, then env.rHERMES_INFERENCE_PROVIDERr%auto)r4r5rrbrr'r.)rr\rE env_providers r-resolve_requested_providerrs)Y__&&)  &&(((!##I==,,L,$$,););)=)=,!!##))+++6;;AACCIIKKL 6r/provider_labelapi_mode_override provider_namecPt||}|sdS t|}|sdS|}|dSt |ddpt |dd}|sdS||pt |pd||d||dS#t $rYdSwxYw) zXCheck if a credential pool exists for a custom endpoint and return a runtime dict if so.rNrrr%r`zpool:)rr_rPrrr)r r has_credentialsselectrr[rK)rPrrrpool_keyrr pool_api_keys r-_try_resolve_from_custom_poolr*s,HMRRRH t""##%% 4  =4u&7>>d'%Q_acBdBd  4&)e-Eh-O-OeSe #(h((#     tts"#BB$B:B B%$B%resultNonecdD]:}||}t|tr|dkr||d<dS;dS)aqPropagate a per-provider output cap onto the resolved runtime dict. Accepts ``max_output_tokens`` or ``max_tokens`` on a ``custom_providers`` entry so a provider block can pin its own output limit. Gateway and CLI map this onto ``AIAgent.max_tokens`` only when the top-level ``model.max_tokens`` isn't set, so the documented global key still wins. )max_output_tokens max_tokensrrN)rbrint)rr_k_vs r-_lift_max_output_tokensr JsY2 YYr]] b#   266*,F& ' FF r/c\t|d}|r||d<dSdS)zCopy a validated ``extra_headers`` dict from a provider entry. SECURITY: header values routinely carry credentials (Cloudflare Access service tokens, proxy auth, custom bearer schemes). Never log them. extra_headersN)r rb)rrr s r-_lift_extra_headersr Ys? ,EIIo,F,FGGM0"/00r/c b t|pd}|sdS|dkrdS|dkri|dsT tj|}|pd|krdSn#t $rYnwxYwt}|d}t|trE| D]/\}}t|tst|}t|ddpd}|r"t|dnd} | s7t|ddpd} |||d|hvr"|dp+|d p|d pd} | r|d || | |d dd } |d} t| trt| | d<t|| t|dp|d} | r| | d<t!|| | cS|d d}|r(t|}|||d|hvr|dp+|d p|d pd} | r|| | |d dd } |d} t| trt| | d<t|| t|dp|d} | r| | d<t!|| | cS1|d}t|trt"ddSt'|}|sdS|D]G}t|ts|d }|d } t|trt| tsnt|}d|}t|ddpd}|rt|nd}|rd|nd}|||||hvr|| t|ddpdd} t|ddpd}|r|| d<|r|| d<|d} t| trt| | d<t|| t|d} | r| | d<t|ddpd}|r|| d<t!|| | cSdS)Nr%rrGr providerskey_envrrvrrPr& default_model)r&rPrr extra_bodyr_ transportcustom_providerszcustom_providers in config.yaml is a dict, not a list. Each entry must be prefixed with '-' in YAML. Run 'hermes doctor' for details. provider_key)r&rPrr)r8rrrr4r5rrrbrritemsr'r.r rar rcwarningr)rrequested_norm canonicalrrep_namer name_normrresolved_api_keyrPrrr_ display_name display_normrr&menu_keyrprovider_key_normprovider_menu_keyrs r-_get_named_custom_providerr!ds45G5M2NNN t"t!!.*C*CI*N*N!  1.AAIR&&((..00NBBtC    D ]]F ;''I)T""=&'oo//< &< &NGUeT** 7@@I%))Ir228b99??AAG?FNww3399;;;B # O#&uyyB'?'?'E2#F#F#L#L#N#N '96K 6K6K!LLL 99U++^uyy/?/?^599ZCXCX^\^" % &' : :$,NN$4$4#3!&?B!?!? F "'|LL !lLBZLBZBZ%[[[$yy//b599U3C3CbuyyQ[G\G\b`bH&$0(0(8(8'7%*YY%C%C "" &+YY|%<%< %j$77D37 3C3CF<0+E6:::#2599Z3H3H3bEIIVaLbLb#c#c#:19F:./v>>>% zz"455"D)) /   t6v>> t!##%&&  yy  99Z(($$$ Jx,E,E  3D99 (Y((599^R88>B??EEGG MYa;LIII_a=NV9&7999TV )X7HJ[!\ \ \ JJLL ((599Y339r::@@BB   eii 2..4"55;;==  ( 'F9   2%1F> "YY|,, j$ ' ' 4#' #3#3F< E6***"599Z#8#899  *!)F: 7B//5266<<>>  )(F7Ov... 4sA== B  B cH t|duS#t$rYdSwxYw)u~Return True when config defines a custom provider matching the request. Thin public wrapper around :func:`_get_named_custom_provider` so other modules (e.g. the cronjob tool) can decide whether a provider name will actually resolve to a configured ``providers:`` / ``custom_providers:`` entry — without reaching into a private helper or duplicating the scan. NF)r!rK)rs r-has_named_custom_providerr#s=)*<==TII uus  !!c~t|}|sdS t}n#t$rYdSwxYw|d}t |t r|D]\}}t |t s|dp+|dp|dpd}t||kr!dtt|cS t|}n#t$rd}YnwxYw|pgD]}t |t s|d}t |tr| sWt|d|krdt|cSdS) uDMap an endpoint URL back to its canonical ``custom:`` menu key. Returns the ``custom:`` slug of the first ``providers:`` / ``custom_providers:`` entry whose base_url matches, or ``None`` when no entry owns the URL. Session persistence stores the agent's *resolved* provider, and for every named custom endpoint that is the literal string ``"custom"`` — the entry name is lost, and the api_key is deliberately never persisted. The endpoint URL is the one durable fact that survives the round-trip, so this reverse lookup lets persist/rebuild paths recover the entry identity (and with it key_env/api_key/api_mode resolution via :func:`_get_named_custom_provider`) instead of failing with ``auth_unavailable`` or silently rebuilding with placeholder credentials. NrrvrrPr%rr&) _normalize_base_url_for_matchrrKrbrrrr8r'rr4) rPtargetrrrr entry_urlrr&s r-find_custom_provider_identityr(s  +8 4 4F t tt ;''I)T""Q'oo// Q QNGUeT**  %  SEIIe$4$4S *8M8MSQS -Y776AAP!@W!N!NPPPPPB :6BB     !'REE%&&  yy  $$$ DJJLL   (:)>)> ? ?6 I ID`` identity for a bare custom provider. The bare string ``"custom"`` is the *resolved billing class* shared by every named ``providers:`` / ``custom_providers:`` entry — it is NOT a routable provider identity (``resolve_runtime_provider("custom")`` falls through to the OpenRouter default URL with no api_key, which surfaces to the user as "No LLM provider configured"). Any code path that persists or restores a session's provider override must run the resolved provider through this helper so a bare ``"custom"`` is upgraded back to its durable ``custom:`` menu key. Two recovery sources, in priority order: 1. ``base_url`` — reverse-lookup the entry that owns the endpoint URL (the one fact that always survives the persistence round-trip when a URL was recorded). 2. ``config_provider`` — the active ``config.model.provider`` (or its ``provider``/``HERMES_INFERENCE_PROVIDER`` equivalent). When the agent was built without a base_url on the override (the recurring Desktop/TUI regression vector), the configured provider is the only durable identity left, so fall back to it when it names a real entry. Returns ``custom:`` when a routable identity is recovered, else ``None`` (caller keeps whatever it had — bare ``"custom"`` only as a last resort, e.g. a genuine ad-hoc endpoint with no config entry). r%rr>rrGrNr) r(r'r4rrbrKosenvironr8r!r)rPr)identityrcandidate_norms r-canonical_custom_identityr/Esf@0::  OO)r**0022I  -//33J??E2FFLLNNII   III  LJNN#>CCIIKK 4Y??N ^/OOOt %i 0 0 <((33 &%%-^-- - =      4s*AA?? B B%D D DDct|pddS)Nr%rS)r'r4rAr5r7s r-r%r%s: u{   ! ! # # * *3 / / 5 5 7 77r/custom_providerc|d}t|tr|siSdt|iS)Nr)rbrr)r1rs r-"_custom_provider_request_overridesr3sF $$\22J j$ ' 'z $z** ++r/explicit_api_keyexplicit_base_urlr5r6c  |pd}|r/|dkr) ddlm}||dkrd}n#t$rYnwxYw|dkr|r|d}t |dd}|rd|d<|St|dpt|d }t|d }|pd|r"td dnd|r"td dndt|g} td | Ddpd} dt|pd|| d|dSt|} | sdS|pdp| ddd}|sdSt |d| d| d}|r| d} | r| |d<t| dtr | d|d<t!| } | r+it#| dpi| |d<| drt#| d|d<|St|dpt|d }t|d }|pdt%| ddpdtt%| ddpdd|r"td dnd|r"td dndt|g} td| Dd} d| dpt|pd|| pdd| d|d}| dr | d|d<t| dtr | d|d<| drt#| d|d<t!| } | r| |d<|S)Nr%rGrrHrSz direct-aliasr openai.comopenai.azure.comrIOPENAI_API_KEYOPENROUTER_API_KEYc38K|]}t||VdSrjr)rmcs r-roz0_resolve_named_custom_runtime..s0 C C1.?.B.B CQ C C C C C Cr/no-key-requiredr`rr_rPrrrrPr_r&rrrrequest_overridesr rrc38K|]}t||VdSrjr=rmrs r-roz0_resolve_named_custom_runtime..s1bb)EVW`EaEabIbbbbbbr/zcustom_provider:rr_rPrr)r4r5rJrrKrArr"r.rnextr[r!rbrrr3rr')rr5r6rrNrP pool_result_da_is_openai_url_da_is_openrouterapi_key_candidatesrr1rrA_cp_is_openai_url_cp_is_openrouterrs r-_resolve_named_custom_runtimerLs).B5577==??N.H44  M M M M M M  00H<P $"4    11CDDO t  b'')) /   z2 . . fSkk  t0(ODWDWXbDcDctCtGtGHNtOtOPPPK%((11  .#-K o))*=>> D D T/>?R/SK+ ,>OO  0{':;;ArBB0#0K+ ,    / / R+/0P+Q+QK (/,GG~K`aik}K~K~//JJ  R&&(( O   2 . . 4"55;;==O'' 266<"==CCEErJJPPRR7H P!2 & & , , . . .b6G P%r * * 0 0 2 2 2b h'' bb/AbbbdfggG#'' 33 #H - - //V_%8%8AS%T%TVVF7##3)'2w/%%&9::C@@K&56I&J"#?++I"&'G"H"H:?KK8&7"# MsA AAc t}t|dtr|dnd}t|dtr|dnd}d}dD]V}||}t|tr*|r|}nW|pd} |}| r/| dkr) ddlm} | | dkrd} n#t$rYnwxYwtdd} td d} d } |r+|s)| d kr |r|d krd } n| dkrt||rd } |pdp"| p | r|ndp| pt d }t|d}|p(| dko"| p|| ko|| pd d k}|r |tdtdg}n~t|d}t|d}t|d}|| r|nd|rtdnd|s|rtdnd|rtdndt|g}td|Dd}|s|rdnd}| dkrdnd}|dkrA|r?t!||t#|d| dkr|nd}|r|S|dkr|s|sd}||dkrt%||n2t#|dpt'|pd|||dS)NrPr%r)rrvrGrrHr!CUSTOM_BASE_URLFrTrSrIrr;r:z ollama.comr8r9OLLAMA_API_KEYc3zK|]6}t|t|pdV7dS)r%N)rr'r4rCs r-roz._resolve_openrouter_runtime..zsIjj)M^_hMiMijY_"   # # % %jjjjjjr/explicitz env/configr_rr?r`rD)rrrbr'r4r5rJrrKr.rOr!rAr"rrErrargr[)rr5r6r\rDrE cfg_api_keykvrrNenv_openrouter_base_urlenv_custom_base_urluse_config_base_urlrP_is_openrouter_url_is_openrouter_contextrI_is_ollama_url_is_openai_url_is_openai_azurerreffective_providerrFs r-_resolve_openrouter_runtimer^s "##I0:9==;T;TVY0Z0Zb9==,,,`bL0:9==;T;TVY0Z0Zb9==,,,`bLK  MM!   a   !'')) ''))K E(.B5577==??N%%''--//L .H44  M M M M M M  00H<>@@  '$5' V # # +<6#9#9&*# x ' ',X ,- - '#'   b''))   $7 ?L   R  #   fSkk  /xII0,& D $ K4K(K D 06B>>sCC C    ( ) ) $ % % 2(LII1(LII1((0J0J,,PT      X%%g%>P%#'  ) )39hGGG Y]]:66 7 7 #H - -    s?E E$#E$)r5r6rc t|pd}t|pdd}t|dpd}d}d}d} i} |dkrt|dpdd}t |dpd}t|d pdpd} |d } t | tr| } t|p|d pd} | r/|d kr) d dlm } | | }n#t$rd}YnwxYw|r|}tddd}|p|p|}|std|d krtjdd|}| dkr|r|}d}d}n d dlm}m}m}n&#t$r}td|d|d}~wwxYwt| dpdp|} ||}||}n/#t&$r"}tt||d}~wwxYw|}d}d}i}|dkr=t| dpd}|r||d<d|||||||dS|}|s' d dlm}|dpd}n#t$rd}YnwxYw|s"tdd}|std|s|rdnd}d|||d||d S)!aResolve an Azure Foundry runtime entry. Reads ``model.base_url`` + ``model.api_mode`` from config.yaml (or explicit overrides), pulls the API key from ``.env`` / env var, and strips a trailing ``/v1`` for Anthropic-style endpoints because the Anthropic SDK appends ``/v1/messages`` internally. When ``model.auth_mode == "entra_id"`` (and the model is OpenAI-style), the returned ``api_key`` is a zero-arg callable produced by :func:`agent.azure_identity_adapter.build_token_provider` rather than a string. Downstream code that constructs an OpenAI SDK client passes this through unchanged (the SDK accepts ``Callable[[], str]`` for ``api_key`` and calls it before every request). Code paths that need a string (logging, manual HTTP probes, header injection) must use the helpers in ``agent.azure_identity_adapter``. Raises :class:`AuthError` when required values are missing. r%rSrr`rrrPr_ auth_modeentrar(rVrrNAZURE_FOUNDRY_BASE_URLzpAzure Foundry requires a base URL. Set it via 'hermes model' or the AZURE_FOUNDRY_BASE_URL environment variable.rentra_idrQ)EntraIdentityConfigSCOPE_AI_AZURE_DEFAULTbuild_token_providerzAzure Foundry Entra ID auth requires the 'azure-identity' package. Install it with: pip install azure-identity (import failed: )scope)rh)r)rr_rPrr`rarr) get_env_valueAZURE_FOUNDRY_API_KEYaAzure Foundry requires an API key. Set AZURE_FOUNDRY_API_KEY in ~/.hermes/.env or run 'hermes model' to configure. To use keyless Microsoft Entra ID auth instead, set model.auth_mode: entra_id in config.yaml (or pick 'Microsoft Entra ID' in 'hermes model').r)rr_rPrr`rr)r'r4rArbr5rarrrrrKr.rrragent.azure_identity_adapterrdrerf ImportErrorhermes_cli.configri)rr\r5r6rexplicit_base_url_cleanrErD cfg_api_mode cfg_auth_mode cfg_entra_entrarrr env_base_urlrPrrr`rdrerfrrh entra_configtoken_provider clean_entraconfigured_scoperis r-_resolve_azure_foundry_runtimerxs14+1r2288::!"3"9r::@@BBII#NNy}}Z006B77==??EEGGLL%LM "I&&9==44:;;AACCJJ3OO &y}}Z'@'@AAWEW IMM+66C)DDJJLLRRTTaXa w'' fd # # I,H)-- *B*BHbIIOOQQO$<+???  F F F F F F33ODDHH   HHH   $#L3R88>>@@GGLLL&F,F,H   ?   +++6)R22  "" ! #,GF!II     .'*...  IMM'**0b117799*)  322    "6!5\!J!J!J 3 3 3C))s2 3$GF"I  " ""9==#9#9#?R@@FFHH  8'7 G$($ " "4   G   7 7 7 7 7 7#m$;<<BGG   GGG  ?1266<<>>   7   - P0A PZZF# 0  sTG&& G54G55 J J# JJ#K88 L$LL$N N%$N%c  t|pd}t|pdd}|s|sdS|dkrt|dpd}d}|dkrZt|dpdd}t |sd}|p|pd}|}|s!ddlm} | }|std dd ||d |d S|d kr|pt}|}d} |sft} | dd}| d} |s+| dddp|}d d||d | |dS|dkrtj dpi} |p`tpRt| dp tjd}|pct| t!dt#ddr6t| dpdnd}| dp| d} |st%t't)dd} | dd}| d} |s+| dddp|}dd||d | |dS|dkrt+|||| St-j|}|re|jdkrYd}|jr:t)|jdd}|}|sF|d!vr9t3|} | ddd}n |p|j}|}|sPt3|} | dd}|s)| ddd}d}|d"krt7||}nC|d#krd}n:t9|d$}|r|}nt;|}|r|}|||d|d |d SdS)%Nr%rSrrrPrrresolve_anthropic_tokenNo Anthropic credentials found. Set ANTHROPIC_TOKEN or ANTHROPIC_API_KEY, run 'claude setup-token', or authenticate with 'claude /login'.rVrQr@rr last_refreshrTrr_rPrrr}rrr<HERMES_NOUS_MIN_KEY_TTL_SECONDS agent_keyagent_key_expires_at expires_atHERMES_NOUS_TIMEOUT_SECONDS15timeout_secondsr`rr_rPrrrrr)rr\r5r6> kimi-codingkimi-coding-cnrrr_)r'r4rArbr5ragent.anthropic_adapterr{rrrrget_provider_auth_staterDEFAULT_NOUS_INFERENCE_URLrmaxr$rfloatr.rxr auth_typebase_url_env_varrrrrar[)rrr\r5r6rErDrPrr{r}credsstaterrenv_urlr_rers r-_resolve_explicit_runtimerJs+1r2288::-344::<<CCCHH $5t;9==44:;;AACCIIKK  ; & &y}}Z88>B??EEGGNNsSSL2<@@ "! $S S8S"  G G G G G G--//G V $,  "4    >!!$>(>"  M577Eii 2..G 99^44L$ M 99Z44;;C@@LH&)  ("4   6088>B  o022 o599122Yh6YZZ``bbiijmnn # #B A4HHII C +&&," - - 3 3 5 5 5  YY566Q%))L:Q:Q  M4 %g.KT&R&R S SEii 2..G<00J$ M 99Z44;;C@@LH*  $"4   ?""-1-/      #H--G+ 7$ 11  # Pg6;;AACCJJ3OOG$ A<<<kr tC}d>d?| ddd | d7d| d8d@| dA|dBS#t$r$|d.hsA&lD99r/r4)rrr\r5r6rOPENAI_BASE_URLr!>rrGT>rrNrrrrrrrrrh)rrrhzINous pool entry agent_key expired/missing, refreshing selected pool entryz"Nous pool entry refresh failed: %szRNous pool entry agent_key still unavailable, falling through to runtime resolution)rrrr\rrrrrrrportalrrrzUAuto-detected Nous provider but credentials failed; falling through to next provider.rrTzhermes-auth-storer}r~zVAuto-detected Codex provider but credentials failed; falling through to next provider.rzZAuto-detected xAI OAuth provider but credentials failed; falling through to next provider.rzqwen-cli expires_at_ms)rr_rPrrrrz@Qwen OAuth credentials failed; falling through to next provider.r oauth_minimax))resolve_minimax_oauth_runtime_credentialsoauthz copilot-acpcommandargsprocess)rr_rPrrrrrr)r api_key_envzNo Azure Anthropic API key found. Set AZURE_ANTHROPIC_KEY or ANTHROPIC_API_KEY, or point key_env/api_key_env in your config.yaml model section at a custom env var.rzr|envbedrock)has_aws_credentialsresolve_aws_auth_env_varresolve_bedrock_regionis_anthropic_bedrock_model> aws-bedrockamazon-bedrockawsamazonrzNo AWS credentials found for Bedrock. Configure one of: - AWS_ACCESS_KEY_ID + AWS_SECRET_ACCESS_KEY - AWS_PROFILE (for SSO / named profiles) - IAM instance role (EC2, ECS, Lambda) Or run 'aws configure' to set up credentials.no_aws_credentials)coderegionzaws-sdk-default-chain guardrailguardrail_identifierguardrail_version)guardrailIdentifierguardrailVersionstream_processing_modestreamProcessingModetracer(zhttps://bedrock-runtime.z.amazonaws.comzaws-sdk)rr_rPrrrbedrock_anthropicrr)rr_rPrrrrguardrail_configrrr_rrrr)>rr4r.rArxragent.vertex_adapterrrrLr'rbr5rr^rrr:r rKrrrrr$rrcrtry_refresh_currentrrrrdrrrrrrrJrrlistrrr{agent.bedrock_adapterrrrrrrrrarrrr[rrr)8rr5r6rr _eff_base _azure_key azure_runtimertokenrPcustom_runtimer\rE_known_cloud_hostsrrexplicit_runtimeshould_use_poolenv_openai_base_urlrUhas_custom_endpointhas_runtime_overriderrrmin_ttl nous_state refreshedrrrr_is_azure_endpointhint_keyenv_varr{rrrr is_explicit _bedrock_cfgr auth_source_grr_current_modelr_rrer _effectiverrrDs8 @r-resolve_runtime_providerrs"4I>>U""*%-,"4    #(b//11I[(([I-E-E  # * * , , 8,b117799 8*B//5577  $,!((--!&"4    _,,61'))-/%    ___::::::++--x H N !* ,,$"4    3-)+N /A+, %5%'' 9==44:;;AACCIIKK 9==44:;;AACC  LL88"  . 6'9%5&7 1C,-)+H "##I0-)+  ,.O<9==44:;;AACCIIKK 9==44:;;AACC %&7<<BBDD")*?"D"D"J"J"L"L"  '" '&    'L,>>>"& #$4$I8IJJ "8 8 )'' )((  &5?y"""4  2$$&&2   0$7765."55  v  %"3"g&GNNOOG$UK>>(/7Mt(T(T 66J ( G<< & hiii% $ 8 8 : :II %%%LL!EsKKK $IIIIII%(%E'8$??>"5."==! &-UK%F%F07?UW[0\0\!(!>!>""J $&+? G+T+T&LL!uvvv#%L   3!#5#)  6 =4 %g.KT&R&R S SE#.!IIj"55<!! =577E*-!IIj"55<#>)HNN,<,<<  @[L,>,>,@,@@  % E6  immH55;<<BBDD#GR006688E DIMM)44:;;AACC 1266<<>>@2B77==?? E  H G G G G G++--E V $, "4    9            ),ii  #6#6#8#8 @ *  #}}((B77 ""8,,299;;W?U?U?W?W..00K4K {B// 77) * * 9sww7J/K/K 9'*+A'B$'(;$<   ww/00 Y;>?W;X !78www 9,/L )\KY]]9-E-EKLLRRTT % %n 5 5 &0MvMMM$% %)&8  GG&.MvMMM$% &8G  ;*:G& ' #H--G6 7$ 114X>> 9==44:;;AACCIIKK  8 # #%MM*55;BBDDKKCPPLH599Z#<#<#C#CC#H#H% y 0EIIiQSrsUMM"""""" !!!!!!&&&&&&&&&&  8 $ $''''''kkkkkkkkkkkk888888$ 100000CCCCCCCCCC / / / / /3333==== 5555<&&&&RBBBB,61616161r""""J.,88888"""""$   0000>+/%)"&LLLLLL^,(,#' @    0000]]]]@    0000j#%)<<<<<<~8888,,,,'+'+ AAAAAAN'+'+ KKKKKKd'+'+"& ffffff\'+'+ XXXXXXz $&*'+"& ______Dr/